Score Higher on Verified NSE7_CDS_AR-7.6 | Fortinet NSE 7 - Public Cloud Security 7.6.4 Architect Exam Questions with Answers

According to the FortiOS 7.6 AWS Administration Guide and the Fortinet Public Cloud Security 7.4 training materials regarding centralized security inspection:

Multiple Route Tables (Option B): A single AWS Transit Gateway is designed to support multiple TGW route tables. By default, there is a soft limit of 20 route tables per Transit Gateway, which allows administrators to implement sophisticated network segmentation and granular routing policies. In a FortiGate-centric "Security Hub" or "Transit VPC" architecture, multiple route tables are used to separate "Spoke" traffic from "Security" traffic, ensuring all inter-VPC traffic is forced through the FortiGate-VM for inspection.

Associations and Propagations: * Association: Each individual TGW attachment (VPC, VPN, or Direct Connect) can be associated with exactly one TGW route table at any given time. This table dictates where packets coming from that attachment will be sent. Because of this 1:1 relationship, Option C is incorrect.

Propagation: An attachment can propagate its routes to one or many TGW route tables. This flexibility allows a VPC's prefix to be known in multiple routing domains, meaning that association and propagation do not need to occur in the same table, making Option A incorrect.

Default Route Table Management: When creating an AWS Transit Gateway, the options for "Default route table association" and "Default route table propagation" are enabled by default, but they can be disabled during or after creation. Disabling these is a security best practice when deploying FortiGate-VMs to prevent the TGW from automatically creating a "full-mesh" connectivity that bypasses the firewall, making Option D incorrect.

Comprehensive and Detailed Explanation From FortiOS 7.6, FortiWeb 7.4 Exact Extract study guide:

Based on the Fortinet Cloud Security 7.4 documentation and the FortiCASB Administration Guide, secur5ing a multi6cloud environment requires specialized tools for Software-as-a-Service (SaaS) visibility:

SaaS Visibility and Protection (Option B): FortiCASB (Cloud Access Security Broker) is a cloud-native service designed specifically to provide insight into users and data stored within major SaaS applications like Office 365, Google Drive, and Salesforce.

Key Capabilities:

Data Discovery: It allows administrators to scan and identify sensitive data (PII, PCI, etc.) stored within SaaS platforms to prevent data leakage.

User Behavior Monitoring: It tracks user activities and alerts on anomalous behavior, such as logins from suspicious locations or excessive file downloads, to ensure secure access.

Threat Protection: It integrates with FortiGuard to scan files within the cloud for malware, providing a layer of security that traditional network firewalls cannot reach once the data is inside the SaaS provider's infrastructure.

Why other options are incorrect:

Option A: FortiSandbox is used for advanced threat detection by executing suspicious files in a safe environment; it does not provide user/data management for SaaS applications.

Option C: FortiWeb is a Web Application Firewall (WAF) designed to protect web applications and APIs hosted on-premises or in the cloud from attacks like SQL injection; it is not a SaaS security broker.

Option D: FortiSIEM is a security information and event management solution used for cross-infrastructure logging and correlation; while it can ingest logs from SaaS, it does not provide the native data-level insights or direct access controls that FortiCASB offers.